Detections
Analytics

Echo: linux: security update to 6.12.85-1

high Tenable Self-Hosted Container Security Plugin ID 465720

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: mm: filemap: fix nr_pages calculation
 overflow in filemap_map_pages() When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I
 encountered some very strange crash issues showing up as "Bad page state": " [ 734.496287] BUG: Bad page
 state in process stress-ng-env pfn:415735fb [ 734.496427] page: refcount:0 mapcount:1
 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb [ 734.496434] flags:
 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff) [ 734.496439] raw: 057fffe000000800
 0000000000000000 dead000000000122 0000000000000000 [ 734.496440] raw: 00000000004cf316 0000000000000000
 0000000000000000 0000000000000000 [ 734.496442] page dumped because: nonzero mapcount " After analyzing
 this page’s state, it is hard to understand why the mapcount is not 0 while the refcount is 0, since this
 page is not where the issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can reproduce the
 crash as well and captured the first warning where the issue appears: " [ 734.469226] page: refcount:33
 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0 [ 734.469304] head: order:5 mapcount:0
 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 734.469315] memcg:ffff000807a8ec00 [ 734.469320]
 aops:ext4_da_aops ino:100b6f dentry name(?):"stress-ng-mmaptorture-9397-0-2736200540" [ 734.469335] flags:
 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff) ...... [ 734.469364] page
 dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1), const struct page *: (const struct folio
 *)_compound_head(page + nr_pages - 1), struct page *: (struct folio *)_compound_head(page + nr_pages -
 1))) != folio) [ 734.469390] ------------[ cut here ]------------ [ 734.469393] WARNING:
 ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468, CPU#90: stress-ng-mlock/9430 [
 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P) [ 734.469555] set_pte_range+0xd8/0x2f8 [ 734.469566]
 filemap_map_folio_range+0x190/0x400 [ 734.469579] filemap_map_pages+0x348/0x638 [ 734.469583]
 do_fault_around+0x140/0x198 ...... [ 734.469640] el0t_64_sync+0x184/0x188 " The code that triggers the
 warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that
 set_pte_range() tried to map beyond the large folio’s size. By adding more debug information, I found that
 'nr_pages' had overflowed in filemap_map_pages(), causing set_pte_range() to establish mappings for a
 range exceeding the folio size, potentially corrupting fields of pages that do not belong to this folio
 (e.g., page->_mapcount). After above analysis, I think the possible race is as follows: CPU 0 CPU 1
 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()
 ....... //shrink the inode->i_size i_size_write(inode, attr->ia_size); //calculate the end_pgoff with the
 new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff =
 min(end_pgoff, file_end); ...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end =
 folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1; ...... //map large folio
 filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size); To fix this
 issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays
 consistent with the file end to avoid ---truncated--- (CVE-2026-31648)

Solution

Update the linux library and its related packages to version 6.12.85-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-31648

Plugin Details

Severity: High

ID: 465720

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.76

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-31648

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2026

Vulnerability Publication Date: 4/24/2026

Reference Information

CVE: CVE-2026-31648